§3.5–308.

    (a)    This section does not apply to a public institution of higher education.

    (b)    Before submitting its information technology project requests, a unit of State government shall submit information in support of the request required by the Secretary for review and determination consistent with § 3.5–301(k) of this subtitle.

    (c)    In reviewing information technology project requests, the Secretary may change a unit’s designation of a major information technology development project.

    (d)    The Secretary shall review and, with the advice of the Secretary of Budget and Management, approve major information technology development projects and specifications for consistency with all statewide plans, policies, and standards, including a systems development life cycle plan.

    (e)    (1)    Subject to paragraph (2) of this subsection, the Secretary shall be responsible for overseeing the implementation of major information technology development projects, regardless of fund source.

        (2)    As part of the Secretary’s responsibilities under this section, the Secretary shall ensure that no funding is provided for the implementation of a major information technology development project unless:

            (i)    the Secretary determines that the unit has the internal capacity to adequately support the project, program management, and responsibility over program activities, including:

                1.    human capital;

                2.    subject matter expertise; and

                3.    technical infrastructure;

            (ii)    within 30 days of awarding a contract, the managing unit sends to the Board of Public Works and the Legislative Policy Committee, in accordance with § 2–1257 of the State Government Article, notice that:

                1.    identifies the project management team;

                2.    affirms that the Department has reviewed and approved the contract; and

                3.    is signed by the head of the unit acknowledging and accepting the accountability for the implementation of the information technology project or product; and

            (iii)    while a unit is managing an active project or product, the unit agrees to report to the Department every 3 months on the project status in a manner requested by the Department.

    (f)    (1)    With the advice of the Secretary of Budget and Management, expenditures for major information technology development projects shall be subject to the approval of the Secretary who shall approve expenditures only when those projects are consistent with statewide plans, policies, and standards.

        (2)    (i)    The Secretary shall make a recommendation to the Secretary of Budget and Management to withhold project funds, regardless of fund source, if:

                1.    a unit of State government is not consistently reporting on the status of a project or projects to the Department in the form and manner required by the Department; or

                2.    the Department determines that project implementation issues exist, including project timeline delays, significant cost increases, vendor nonperformance, decreased agency capacity, or other issues that indicate issues of concern that could jeopardize successful implementation.

            (ii)    Notwithstanding any other provision of law, and except as provided in subparagraph (iii) of this paragraph, the Secretary of Budget and Management shall withhold any unexpended funds appropriated in a fiscal year for a major information technology development project at the Secretary’s recommendation issued under subparagraph (i) of this paragraph.

            (iii)    The Secretary of Budget and Management may release funds withheld under this paragraph at the direction of the Secretary if the Secretary determines that the issue leading to the initial withholding of funds has been addressed.

        (3)    Within 30 days after funding is withheld in accordance with this subsection, the Department shall report on the purpose of the withholding:

            (i)    to the Governor; and

            (ii)    subject to § 2–1257 of the State Government Article, to:

                1.    the Senate Budget and Taxation Committee;

                2.    the Senate Committee on Education, Energy, and the Environment;

                3.    the House Appropriations Committee;

                4.    the House Health and Government Operations Committee; and

                5.    the Joint Committee on Cybersecurity, Information Technology, and Biotechnology.

        (4)    (i)    Subject to subparagraph (ii) of this paragraph:

                1.    the Secretary may recommend to the Secretary of Budget and Management that funding withheld under this section be reallocated to other expenses of the Information Technology Investment Fund under § 3.5–309 of this subtitle; and

                2.    the Secretary of Budget and Management may, at their discretion, follow the Secretary’s recommendation to reallocate funds.

            (ii)    If the reallocated funds exceed $500,000, the Secretary, in consultation with the Secretary of Budget and Management, shall submit a proposal to the Legislative Policy Committee for a 60–day review and comment period.

    (g)    (1)    The Secretary shall approve funding for major information technology development projects, expedited projects, and other expenditures from the Fund only when:

            (i)    the major information technology development projects or the expedited projects are in compliance with statewide plans, policies, and standards, as determined by the Secretary; and

            (ii)    the major information technology development projects are supported by an approved systems development life cycle plan.

        (2)    An approved systems development life cycle plan shall include submission of:

            (i)    a project planning request that details initial planning for the project, including:

                1.    the project title, appropriation code, and summary;

                2.    a description of:

                A.    the business and technology outcomes to be achieved by the project;

                B.    the features available to the end user on completion, including user acceptance testing and accessibility plans;

                C.    the potential risks associated with the project;

                D.    possible alternatives; and

                E.    the scope and complexity of the project; and

                3.    an estimate of:

                A.    the total costs required to complete through planning; and

                B.    the fund sources available to support planning costs; and

            (ii)    a project implementation request to begin full design, development, and implementation of the project after the completion of planning, including:

                1.    the project title, appropriation code, and summary;

                2.    a description of:

                A.    the business and technology outcomes to be achieved by the project and the metrics by which the success of those outcomes will be measured;

                B.    the features available to the end user on completion, including user acceptance testing and accessibility plans;

                C.    the potential risks associated with the project;

                D.    possible alternatives;

                E.    the scope and complexity of the project; and

                F.    how the project meets the goals of the statewide master plan; and

                3.    an estimate of:

                A.    the total project cost, by phase; and

                B.    the fund sources to be utilized.

        (3)    The Secretary may approve funding incrementally, consistent with the systems development life cycle plan.

    (h)    On or before July 1, 2026, the Department shall:

        (1)    develop standards for units of State government to assist in identifying legacy systems that require modernization projects appropriate to be financed as an expedited project through the Fund;

        (2)    adopt an Information Technology Investment Maturity Model that includes:

            (i)    criteria to inform and prioritize investment decisions;

            (ii)    processes to develop the information required to evaluate investment proposals against the criteria under item (i) of this item; and

            (iii)    management processes to monitor the implementation of approved modernization projects; and

        (3)    develop a State Modernization Plan.